Memory Forensics- Zeus
We are analyzing the zeus malware sample.
Gitclone the volatility repo from https://github.com/volatilityfoundation/volatility.git
We would need python2 to run the volatility commands
imageinfo: This plugin attempts to identify the OS and suggested profiles.
From here, let’s suppose it’s the WinXPSP2x86(Windows XP SP2 (32bit)) …
Process Listing
Cmd.exe for a second sus! Spawned by vmtool, service of vmware…why would it directly spawn cmd! Let’s see more
Process Tree
because cmd.exe is indented one more level than vmtoolsd.exe directly above it in the pstree output, it means vmtoolsd.exe is the direct parent of cmd.exe.
cmd.exe being spawned by vmtoolsd.exe is highly unusual. vmtoolsd.exe is a legitimate VMware service, and it should not be spawning cmd.exe. This is a strong indicator of suspicious activity, potentially a malicious process injecting into vmtoolsd.exe or vmtoolsd.exe being exploited to launch cmd.exe.
psxview
VMip.exe (PID 1944) was a hidden process. It was not in the PsActiveProcessHead list, indicating potential rootkit or malware activity designed to conceal its presence. It also exited around the time of the dump.
cmd.exe (PID 124) was not hidden, but its quick execution and suspicious parent vmtoolsd.exe remain the primary suspicious points.
I were unable to retrieve the command lines for either cmd.exe or VMip.exe. This happens when processes exit very quickly or employ specific evasion techniques.
The cmd closed very quickly so its dump wasn’t created and the vmip was a silent process so it was also not recorded.
Next, I checked for some network connections, Here’s what I found
svchost.exe (PID 856) was actively connecting to 193.104.41.75:80 svchost.exe (PID 856) was also listening on a high, non-standard TCP port (29220).
Let’s check the reputation of the IP address listed here using VirusTotal.
It doesn’t look suspicious but we know it can be we’ll see it further.
Now I wanted to see if svchost loaded any obviously malicious or misplaced DLLs.
All DLLs listed are legitimate Windows system DLLs.
Malfind
The malfind output confirms that svchost.exe (PID 856) has injected code within its memory space.
Multiple Suspicious Regions: Volatility’s malfind plugin found two distinct memory regions that exhibit characteristics of malicious injection:
• Address: 0xb70000
Get Pretty_Knight’s stories in your inbox
Join Medium for free to get updates from this writer.
• Address: 0xcb0000
Legitimate code segments usually have PAGE_EXECUTE_READ (RX) permissions (they can be read and executed, but not written to).
PAGE_EXECUTE_READWRITE (RXW) is highly suspicious because it allows code to be both written into memory and then executed from that same location. This is a common technique used by malware for injecting payloads, unpacking, or dynamically loading malicious modules. we saw that this process had made suspicious network communications and also we suspect code injection. So let’s not stop here.
Let’s try dumping the region of memory where we think that the malicious code is injected and analyze it. For this we can use the vaddump plugin and provide the PID, base address of the memory region that we suspect from the output of malfind.
Alright! Our guess was not wrong. This memory region is indeed malicious confirming code injection.
Malware commonly uses specific registry keys (and other mechanisms) to ensure they are re-executed every time the system starts or a user logs in. These are standard locations where legitimate applications also register themselves to start automatically.
Hivescan
Using the hivescan plugin to list all identified registry hives:
The Userinit value specifies programs that run when a user logs on, immediately after userinit.exe finishes its legitimate tasks. The presence of ,C:\WINDOWS\system32\sdra64.exe, appended to the legitimate userinit.exe means that sdra64.exe is configured to execute every time a user logs into the system.
We can see that the PID 632 has a handle to the file “sdra64.exe”. Grepping for that PID from the output of psscan, we can see that this process is “winlogon.exe”.
Key findings
C2 connection
193.104.41.75
Processes with injected code svchost.exe winlogon.exe
Registry entry
Key: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows
NT\CurrentVersion\Winlogon
Value: Userinit
Data: C:\WINDOWS\system32\sdra64.exe
File
Name: sdra64.exe
Path: C:\WINDOWS\system32\sdra64.exe
Hash: b38783113eda00bbe864d54fda9db97e36ee9fc8e4509e3dc71478a46 250f498
The memory forensics investigation of the zeus.vmem dump revealed a clear Zeus malware infection, starting with svchost.exe (PID 856) communicating with a known Zeus Command and Control server at 193.104.41.75:80. Further analysis confirmed malicious code injection, identified by an MZ header, within this svchost.exe process. Additionally, VMip.exe (PID 968) was found as a hidden malicious process, originating from explorer.exe and subsequently launching cmd.exe. Crucially, the malware established persistence by modifying the Winlogon\Userinit registry key to execute
That’s it! I hope you enjoyed it as much as i did investigating it :)
